icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Digital Shadows Add-on for Splunk
SHA256 checksum (digital-shadows-add-on-for-splunk_101.tgz) f820cb05e274456dde4e4625d0e5f82c6bfd64ff52dc78d6f1683fa3d0791dac SHA256 checksum (digital-shadows-add-on-for-splunk_100.tgz) f253e5815dc94954c8e6f73e740888fb9fa713f3b5653f9e1ebd6ad8049c7e66
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Digital Shadows Add-on for Splunk

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Digital Shadows monitors and manages an organization’s digital risk across the widest range of data sources within the visible, deep, and dark web to protect an organization’s business, brand, and reputation. The Digital Shadows SearchLight™ service combines scalable data analytics with human data analysts to manage and mitigate risks associated with an organization’s brand exposure, VIP exposure, cyber threat, data loss, infrastructure exposure, physical threat, and third party risk. SearchLight creates an up-to-the minute view of an organization’s external digital risk with tailored threat intelligence.

Technology Add-on for Digital Shadows is used to fetch data from SearchLight portal from Digital Shadow and indexes it in Splunk for further analysis.

**Active subscription to Digital Shadows SearchLight service is required. API credentials can be provided upon request.

Technology Add-on for Digital Shadows

The Technology Add-on for Digital Shadows is used to fetch data from SearchLight portal from Digital Shadow and indexes it in Splunk for further analysis.

Author – Digital Shadows
Version - 1.0.0
Creates Index - False
Compatible with:
Splunk Enterprise version: 6.6.x, 7.0.x, 7.1.x
OS: Platform independent


1) Standalone Mode: Install Add-on app on a single machine. This single machine would serve as a Search Head + Indexer + Heavy forwarder for this setup
2) Distributed Environment: Install Add-on on search head and Add-on on Heavy forwarder.
* Add-on needs to be installed and configure on Heavy Forwarder for data collection.
* Execute below command to forward data from heavy forwarder to indexer.
* $SPLUNK_HOME/bin/splunk add forward-server <indexer_ip_address>:9997
* On Indexer machine, enable event listening on port 9997 (recommended by Splunk).
* Execute below command to forward data from heavy forwarder to indexer.
* Add-on needs to be installed on the search head machine and accounts need to be configured. Reason to have Add-on on Search Head is mentioned below.
* Search time extraction
* CIM mapping
* Adaptive response action
* Macro definition will be needed
3) When configuring the input, do not enable "Global Incidents" until after fully executing the first data pull for private incidents. Once that is complete you can enable Global Incidents in the input config, save and exit. Global Incident will then be processed.

** Note: By default, all data is indexed to the main index. If you want to use a custom index then kindly update "get_digitalshadows_index" macro in Technology Add-on for Digital Shadows.
The account needs to be configured with an account which has admin access on Splunk.

A good test to see that you are receiving all of the data we expect is to run below searches after several minutes:
* Execute below search in case TA-digital-shadows Add-on has been installed and configured.
get_digitalshadows_index | stats count by sourcetype

In particular, you should see below sourcetypes:
* credential:compromise
* incidents
* intel_incidents
* intel_ioc_incidents
* pipeline
* If a user doesn’t see data, try expanding time range.
* Environment variable SPLUNK_HOME must be set
* Authentication Failure:
Check the network connectivity and make sure that the Digital Shadows server is reachable by executing “ping <server>” command on terminal or command prompt.
* Adaptive Response Action Failure:
* User can view update_digital_shadows_incident_status_modalert.log” file located at $SPLUNK_HOME/var/log/splunk or can execute “index=cim_modactions sourcetype=modular_alerts:update_digital_shadows_incident_status” query to get more details of the failure.
* User needs to run Action with admin account.
* To troubleshoot Digital Shadows SearchLight mod-input check $SPLUNK_HOME/var/log/splunk/ta_digital_shadows_digital_shadows_searchlight.log file.

* Support Offered: Yes
* Support Email:support@digitalshadows.com

Release Notes

Version 1.0.1
Dec. 30, 2019

This is a minor update to include Threat Intel incident IDs for correlation.

Version 1.0.0
Oct. 12, 2018


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.